CVE-2022-22138 Denial of Service (DoS)
An attacker can cause a segmentation fault and denial of service in applications using the fast-string-search library by providing non-string inputs.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2022-22138?
CVE-2022-22138 is a high-severity denial of service vulnerability in fast-string-search, published on 17 Jun 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
All versions of package fast-string-search are vulnerable to Denial of Service (DoS) when computations are incorrect for non-string inputs. One can cause the V8 to attempt reading from non-permitted locations and cause a segmentation fault due to the violation.
Weakness: CWE-682
Which versions are affected by CVE-2022-22138?
2 open source packages ship an affected version, including fast-string-search. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
fast-string-search npm | All versions to 1.4.3 | None |
fast-string-search npm | All versions to 1.4.3 | None |
Products include Fast String Search Project Fast String Search.
How do I fix CVE-2022-22138?
No fix has been published for CVE-2022-22138 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2022-22138 being exploited?
There is no known exploitation of CVE-2022-22138 in the wild and no public exploit code.
Other vulnerabilities in fast-string-search
Sources
Also known as GHSA-4263-q746-94mw.